﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Management;
using System.Xml;
using System.IO;

namespace FEP
{
    public class AntimalwareHealthStatus
    {
        public bool AntispywareEnabled;
        public int AntispywareSignatureAge;
        public string AntispywareSignatureUpdateDateTime;
        public string AntispywareSignatureVersion;
        public bool AntivirusEnabled;
        public int AntivirusSignatureAge;
        public string AntivirusSignatureUpdateDateTime;
        public string AntivirusSignatureVersion;
        public bool BehaviorMonitorEnabled;
        public bool Enabled;
        public string EngineVersion;
        public bool IoavProtectionEnabled;
        public int LastFullScanAge;
        public string LastFullScanDateTimeEnd;
        public string LastFullScanDateTimeStart;
        public int LastFullScanSource;
        public int LastQuickScanAge;
        public string LastQuickScanDateTimeEnd;
        public string LastQuickScanDateTimeStart;
        public int LastQuickScanSource;
        public string Name;
        public bool NisEnabled;
        public string NisEngineVersion;
        public string NisSignatureVersion;
        public bool OnAccessProtectionEnabled;
        public string PackedXml;
        public int ProductStatus;
        public int RealTimeScanDirection;
        public bool RtpEnabled;
        public string SchemaVersion;
        public string Version;


        public static AntimalwareHealthStatus GetCurrent(string SourceMachine)
        {
            //\\\\sw
            AntimalwareHealthStatus retval = new AntimalwareHealthStatus();
            ManagementScope scope = new ManagementScope(SourceMachine + "\\root\\Microsoft\\SecurityClient");
            scope.Connect();

            ObjectQuery query = new ObjectQuery("SELECT * FROM AntimalwareDetectionStatus");
            ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);
            Helper helper = new Helper();
            foreach (ManagementObject queryObj in searcher.Get())
            {

                retval.AntispywareEnabled = helper.BoolConvert(queryObj["AntispywareEnabled"].ToString());
                retval.AntispywareSignatureAge = helper.IntConvert(queryObj["AntispywareSignatureAge"].ToString());
                retval.AntispywareSignatureUpdateDateTime = queryObj["AntispywareSignatureUpdateDateTime"].ToString();
                retval.AntispywareSignatureVersion = queryObj["AntispywareSignatureVersion"].ToString();
                retval.AntivirusEnabled = helper.BoolConvert(queryObj["AntivirusEnabled"].ToString());
                retval.AntivirusSignatureAge = helper.IntConvert(queryObj["AntivirusSignatureAge"].ToString());
                retval.AntivirusSignatureUpdateDateTime = queryObj["AntivirusSignatureUpdateDateTime"].ToString();
                retval.AntivirusSignatureVersion = queryObj["AntivirusSignatureVersion"].ToString();
                retval.BehaviorMonitorEnabled = helper.BoolConvert(queryObj["BehaviorMonitorEnabled"].ToString());
                retval.Enabled = helper.BoolConvert(queryObj["Enabled"].ToString());
                retval.EngineVersion = queryObj["EngineVersion"].ToString();
                retval.IoavProtectionEnabled = helper.BoolConvert(queryObj["IoavProtectionEnabled"].ToString());
                retval.LastFullScanAge = helper.IntConvert(queryObj["LastFullScanAge"].ToString());
                retval.LastFullScanDateTimeEnd = queryObj["LastFullScanDateTimeEnd"].ToString();
                retval.LastFullScanDateTimeStart = queryObj["LastFullScanDateTimeStart"].ToString();
                retval.LastFullScanSource = helper.IntConvert(queryObj["LastFullScanSource"].ToString());
                retval.LastQuickScanAge = helper.IntConvert(queryObj["LastQuickScanAge"].ToString());
                retval.LastQuickScanDateTimeEnd = queryObj["LastQuickScanDateTimeEnd"].ToString();
                retval.LastQuickScanDateTimeStart = queryObj["LastQuickScanDateTimeStart"].ToString();
                retval.LastQuickScanSource = helper.IntConvert(queryObj["LastQuickScanSource"].ToString());
                retval.Name = queryObj["Name"].ToString();
                retval.NisEnabled = helper.BoolConvert(queryObj["NisEnabled"].ToString());
                retval.NisEngineVersion = queryObj["NisEngineVersion"].ToString();
                retval.NisSignatureVersion = queryObj["NisSignatureVersion"].ToString();
                retval.OnAccessProtectionEnabled = helper.BoolConvert(queryObj["OnAccessProtectionEnabled"].ToString());
                retval.PackedXml = queryObj["PackedXml"].ToString();
                retval.ProductStatus = helper.IntConvert(queryObj["ProductStatus"].ToString());
                retval.RealTimeScanDirection = helper.IntConvert(queryObj["RealTimeScanDirection"].ToString());
                retval.RtpEnabled = helper.BoolConvert(queryObj["RtpEnabled"].ToString());
                retval.SchemaVersion = queryObj["SchemaVersion"].ToString();
                retval.Version = queryObj["Version"].ToString();

                string bt = "";
            }
            string bt2 = "";

            return new AntimalwareHealthStatus();
        }
    }
    public class Malware
    {
        public bool ActionSuccess;
        public string ActionTime;
        public int CategoryID;
        public int CleaningAction;
        public string DetectionID;
        public int DetectionSource;
        public string DetectionTime;
        public string Domain;
        public int ErrorCode;
        public int ExecutionStatus;
        public string PackedXml;
        public string Path;
        public int PendingActions;
        public string Process;
        public string ProductVersion;
        public string SchemaVersion;
        public int SeverityID;
        public int ThreatID;
        public string ThreatName;
        public string User;
        public Malware GetCurrent(string SourceMachine)
        {
            //\\\\sw
            Malware retval = new Malware();
            ManagementScope scope = new ManagementScope(SourceMachine + "\\root\\Microsoft\\SecurityClient");
            scope.Connect();

            ObjectQuery query = new ObjectQuery("SELECT * FROM Malware");
            ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);
            Helper helper = new Helper();
            foreach (ManagementObject queryObj in searcher.Get())
            {
                retval.ActionSuccess = helper.BoolConvert(queryObj["ActionSuccess"].ToString());
                retval.ActionTime = queryObj["ActionTime"].ToString();
                retval.CategoryID = helper.IntConvert(queryObj["CategoryID"].ToString());
                retval.CleaningAction = helper.IntConvert(queryObj["CleaningAction"].ToString());
                retval.DetectionID = queryObj["DetectionID"].ToString();
                retval.DetectionSource = helper.IntConvert(queryObj["DetectionSource"].ToString());
                retval.DetectionTime = queryObj["DetectionTime"].ToString();
                retval.Domain = queryObj["Domain"].ToString();
                retval.ErrorCode = helper.IntConvert(queryObj["ErrorCode"].ToString());
                retval.ExecutionStatus = helper.IntConvert(queryObj["ExecutionStatus"].ToString());
                retval.PackedXml = queryObj["PackedXml"].ToString();
                retval.Path = queryObj["Path"].ToString();
                retval.PendingActions = helper.IntConvert(queryObj["PendingActions"].ToString());
                retval.Process = queryObj["Process"].ToString();
                retval.ProductVersion = queryObj["ProductVersion"].ToString();
                retval.SchemaVersion = queryObj["SchemaVersion"].ToString();
                retval.SeverityID = helper.IntConvert(queryObj["SeverityID"].ToString());
                retval.ThreatID = helper.IntConvert(queryObj["ThreatID"].ToString());
                retval.ThreatName = queryObj["ThreatName"].ToString();
                retval.User = queryObj["User"].ToString();
            }
            return retval;
        }
    }
    public class AntimalwareDetectionStatus
    {
        public int CategoryID;
        public string DetectionID;
        public int DetectionSource;
        public string DetectionTime;
        public string Domain;
        public int ErrorCode;
        public int ExecutionStatus;
        public int MitigationAction;
        public int PendingActions;
        public string Process;
        public string[] Resources;
        public int SeverityID;
        public int ThreatID;
        public string ThreatName;
        public string User;

        public AntimalwareDetectionStatus[] ParseAll(string XML)
        {
            List<AntimalwareDetectionStatus> retval = new System.Collections.Generic.List<AntimalwareDetectionStatus>();
            XmlDocument xmlDoc = new XmlDocument(); //* create an xml document object. 
            StringReader sr = new System.IO.StringReader(XML);
            xmlDoc.Load(sr);
            foreach (XmlElement a in xmlDoc.DocumentElement)
            {
                retval.Add(Parse(a.InnerXml));
            }
            return retval.ToArray();
        }
        private AntimalwareDetectionStatus Parse(string XML)
        {
            AntimalwareDetectionStatus retval = new AntimalwareDetectionStatus();
            Helper helper = new Helper();
            XmlDocument xmlDoc = new XmlDocument(); //* create an xml document object. 
            StringReader sr = new System.IO.StringReader(XML);
            xmlDoc.Load(sr);
            retval.CategoryID = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[10].InnerText);
            retval.DetectionID = xmlDoc.ChildNodes[0].ChildNodes[11].InnerText;
            retval.DetectionSource = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[12].InnerText);
            retval.DetectionTime = xmlDoc.ChildNodes[0].ChildNodes[13].InnerText;
            retval.Domain = xmlDoc.ChildNodes[0].ChildNodes[14].InnerText;
            retval.ErrorCode = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[15].InnerText);
            retval.ExecutionStatus = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[16].InnerText);
            retval.MitigationAction = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[17].InnerText);
            retval.PendingActions = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[18].InnerText);
            retval.Process = xmlDoc.ChildNodes[0].ChildNodes[19].InnerText;
            retval.Resources = getResources(xmlDoc.ChildNodes[0].ChildNodes[20].InnerXml);
            retval.SeverityID = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[21].InnerText);
            retval.ThreatID = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[22].InnerText);
            retval.ThreatName = xmlDoc.ChildNodes[0].ChildNodes[23].InnerText;
            retval.User = xmlDoc.ChildNodes[0].ChildNodes[24].InnerText;


            return retval;
        }
        private string[] getResources(string XML)
        {
            List<string> retval = new System.Collections.Generic.List<string>();
            XmlDocument xmlDoc = new XmlDocument(); //* create an xml document object. 
            StringReader sr = new System.IO.StringReader(XML);
            xmlDoc.Load(sr);
            foreach (XmlNode a in xmlDoc.ChildNodes[0].ChildNodes)
            {
                retval.Add(a.InnerText);
            }

            return retval.ToArray();
        }
    }
    public class AntimalwareInfectionStatus
    {
        public int ComputerStatus;
        public AntimalwareDetectionStatus[] CriticallyFailedDetections;
        public string PackedXml;
        public AntimalwareDetectionStatus[] PendingActionDetections;
        public bool PendingFullScan;
        public bool PendingManualSteps;
        public bool PendingOfflineScan;
        public bool PendingReboot;
        public AntimalwareDetectionStatus[] RecentlyCleanedDetections;
        public string SchemaVersion;
        public static AntimalwareInfectionStatus GetCurrent(string SourceMachine)
        {
            //\\\\sw
            AntimalwareInfectionStatus retval = new AntimalwareInfectionStatus();
            ManagementScope scope = new ManagementScope(SourceMachine + "\\root\\Microsoft\\SecurityClient");
            scope.Connect();

            ObjectQuery query = new ObjectQuery("SELECT * FROM AntimalwareInfectionStatus");
            ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);
            Helper helper = new Helper();
            AntimalwareDetectionStatus ads = new AntimalwareDetectionStatus();
            foreach (ManagementObject queryObj in searcher.Get())
            {
                string ints = queryObj["PackedXML"].ToString();
                XmlDocument xmlDoc = new XmlDocument(); //* create an xml document object. 
                StringReader sr = new System.IO.StringReader(ints);
                xmlDoc.Load(sr);
                retval.ComputerStatus = helper.IntConvert(xmlDoc.ChildNodes[0].ChildNodes[0].InnerText);
                retval.CriticallyFailedDetections = ads.ParseAll(xmlDoc.ChildNodes[0].ChildNodes[1].InnerXml);
                retval.PackedXml = ints;
                retval.PendingActionDetections = ads.ParseAll(xmlDoc.ChildNodes[0].ChildNodes[3].InnerXml);
                retval.PendingFullScan = helper.BoolConvert(xmlDoc.ChildNodes[0].ChildNodes[4].InnerText);
                retval.PendingManualSteps = helper.BoolConvert(xmlDoc.ChildNodes[0].ChildNodes[5].InnerText);
                retval.PendingOfflineScan = helper.BoolConvert(xmlDoc.ChildNodes[0].ChildNodes[6].InnerText);
                retval.PendingReboot = helper.BoolConvert(xmlDoc.ChildNodes[0].ChildNodes[7].InnerText);
                retval.RecentlyCleanedDetections = ads.ParseAll(xmlDoc.ChildNodes[0].ChildNodes[8].InnerXml);
                retval.SchemaVersion = xmlDoc.ChildNodes[0].ChildNodes[9].InnerText;

                //* Display the results. 
                string bt = "";
            }

            return retval;
        }

    }
     

}
